基于半径证书（eap）authentication

我们目前正在build立一个freeradius服务器，使用证书通过无线连接进行身份validation。我们对802.1x有效，但是Novell的Windows 7客户端打破了802.1x协议。所以我们必须有基于证书的authentication。

我有一个testing域设置和运行，我可以定期内部/外部authentication发生。一旦我实施的证书是事情开始疯狂的时候。我已经附加了我的半径-X输出（至less是它尝试实例化EAP模块的部分），我已经search到了答案但是还没有find任何东西，任何帮助都将不胜感激。

Module: Instantiating eap eap { default_eap_type = "eap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } rlm_eap: Unknown default EAP type eap /etc/raddb/eap.conf[17]: Instantiation failed for module "eap" /etc/raddb/sites-enabled/inner-tunnel[223]: Failed to load module "eap". /etc/raddb/sites-enabled/inner-tunnel[176]: Errors parsing authenticate section.

我们对802.1x有效，但是Novell的Windows 7客户端打破了802.1x协议。 所以我们必须有基于证书的authentication。

这对我来说没有意义。无论您是使用EAP-PEAP，EAP-TLS还是EAP-TTLS，您的请求者都需要与802.1x进行通信。如果Novell的客户端真正破坏了802.1x，那么无论您决定使用哪种身份validation机制（EAPOL本身通过EAPOL隧道连接），802.1x都需要您的请求者和身份validation者支持，否则无法使其工作。

你所说的问题可能在这里：

 rlm_eap: Unknown default EAP type eap /etc/raddb/eap.conf[17]: Instantiation failed for module "eap"

您不能将EAP身份validation机制设置为EAP。 EAP只是一个authentication框架 – 因此是可扩展authentication协议。您需要为EAPselect一个协议。

你提到的证书，所以我假设你正在实施EAP-TLS。你可能想要改变：

 default_eap_type = "eap"

至

 eap: default_eap_type = "tls"